hxxp://pos[.]gosuslugi[.]ru

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2023, 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://pos.gosuslugi.ru

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
1500	msedge.exe
1500	msedge.exe
2500	identity_helper.exe
2500	identity_helper.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1312	1500	msedge.exe	31
PID 1500 wrote to memory of 1312	1500	msedge.exe	31
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1412	1500	msedge.exe	87
PID 1500 wrote to memory of 1996	1500	msedge.exe	85
PID 1500 wrote to memory of 1996	1500	msedge.exe	85
PID 1500 wrote to memory of 3792	1500	msedge.exe	86
PID 1500 wrote to memory of 3792	1500	msedge.exe	86
PID 1500 wrote to memory of 3792	1500	msedge.exe	86
PID 1500 wrote to memory of 3792	1500	msedge.exe	86
PID 1500 wrote to memory of 3792	1500	msedge.exe	86
PID 1500 wrote to memory of 3792	1500	msedge.exe	86
PID 1500 wrote to memory of 3792	1500	msedge.exe	86
PID 1500 wrote to memory of 3792	1500	msedge.exe	86
PID 1500 wrote to memory of 3792	1500	msedge.exe	86
PID 1500 wrote to memory of 3792	1500	msedge.exe	86
PID 1500 wrote to memory of 3792	1500	msedge.exe	86
PID 1500 wrote to memory of 3792	1500	msedge.exe	86
PID 1500 wrote to memory of 3792	1500	msedge.exe	86
PID 1500 wrote to memory of 3792	1500	msedge.exe	86
PID 1500 wrote to memory of 3792	1500	msedge.exe	86
PID 1500 wrote to memory of 3792	1500	msedge.exe	86
PID 1500 wrote to memory of 3792	1500	msedge.exe	86
PID 1500 wrote to memory of 3792	1500	msedge.exe	86
PID 1500 wrote to memory of 3792	1500	msedge.exe	86
PID 1500 wrote to memory of 3792	1500	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pos.gosuslugi.ru
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe76a46f8,0x7ffbe76a4708,0x7ffbe76a4718
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,5736317945260723960,8813815421378783948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,5736317945260723960,8813815421378783948,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,5736317945260723960,8813815421378783948,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5736317945260723960,8813815421378783948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5736317945260723960,8813815421378783948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5736317945260723960,8813815421378783948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,5736317945260723960,8813815421378783948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,5736317945260723960,8813815421378783948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5736317945260723960,8813815421378783948,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5736317945260723960,8813815421378783948,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5736317945260723960,8813815421378783948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5736317945260723960,8813815421378783948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,5736317945260723960,8813815421378783948,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1492 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d5af55f794f9a10c5943d2f80dde5c5

SHA1
5252adf87d6bd769f2c39b9e8eba77b087a0160d

SHA256
43e50edafcaaeae9fcd4dce5b99bf14fe79dae1401019443f31aa9ff81347764

SHA512
2e2e09a00db732ff934da1e6ab8617fb3c8de482f9667a2c987435d0a5d67550b4bfd66e8b4475012b60908c24e39dff58e2f2ffa55f13ffc55caae1be630c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
2e49ee86683ad9baf31654b8cf2aefd8

SHA1
093bb651062f532a150b4fd3006d5f8472bd292d

SHA256
21ff7954b51f1203c5a404e731d199589e540866641877f5f3403836a3d18c67

SHA512
da7507f52074a857d34a7167c6a30104142218ac6ddda0cc0859d6e6609657eb7335fbcd53ecd05f9d5921a24fa16687bdbd983c836ee5460a1d3bcf3b155f94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
1ba807dff113f64ceb3a4b8eb06b430b

SHA1
d3b5191e37fb2662eca40cd87f4e9caeb3893993

SHA256
5c758fedd51f8e100571438f0d21511c95488aa8bc5ac4b751ed5f349f86e047

SHA512
dcdaa5e579874521d82820fe236fd25c8916738534335f7fba02a426199a756e1b2b9e5274af7809ce48adc3f86793544bf9ef8e175270274c884823404d1f23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
94f754bb01bbbdaa9345cbb9a6b8a09c

SHA1
23d009c6af5940c8d585257c2c4a4dd233fd7052

SHA256
ee229572422797ec7a5c0c162fd36b57a338262fb9b66dea920840ebbc5759bb

SHA512
a8e54e898f7d7c672ef2c288a76caef021e72b5b7daa3fa94f22499c6f0750bf242cb05e7e801c9f83c30d5fefa7542a76ba4e9f5d755b19b07bd66c554015b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3fefe6fad9c6e4fd8d062d05d8dde17d

SHA1
8ca2bf94c007ed7ebcffd419534f91db12dfc85d

SHA256
093754470c0068a0d63d28109fd01deb8b309d1dc75526b86f2012c08b74c7c0

SHA512
eac623cec6bdfe07540c8cec339b63271d1c9b8d469151c63664821fc3b3139018bb1fb9208eec5b42383080d4c2b376d92c68b773099dae5a707965c20cd8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
10f5b64000466c1e6da25fb5a0115924

SHA1
cb253bacf2b087c4040eb3c6a192924234f68639

SHA256
d818b1cebb2d1e2b269f2e41654702a0df261e63ba2a479f34b75563265ee46b

SHA512
8a8d230594d6fade63ecd63ba60985a7ccd1353de8d0a119543985bf182fdbb45f38ccc96441c24f0792ea1c449de69563c38348c2bedb2845522a2f83a149db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5cd86e79df15a4c7e93fb24351ba1af3

SHA1
2a2f6bd68c7686ce78cae96646f5c9a7addc0e1a

SHA256
aacb11b1004ff9f06f66ea658efa5b58cd935c4ae4dd8a0cd3f41d0330072126

SHA512
b6e6a82c08921d7e9df50f6d4424f70bae2f7aa7d4d64af1e070a3d4adb5db7b6f0678b675c304f554cc96a5da72acd6d068fdc7912b6556bbcdf5885c6b9a70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7a06b3ebed15a51bd7dde51c0a0be70b

SHA1
44283848c22e83041fb117be5464f897c6c512ea

SHA256
93f2e8a32954431c299fc24e9f4b9dfc0120ea841a5fc9c062285f5e9634c409

SHA512
6ebb4d4500c5b1dc10cd276c003387fc3e26acdf21c3b0ca69272b718b535ba2a90de4f119c73af5dc3b9c7376b97ea14a381db236b860573a520afbc12cc84e

Download Submit